CVE-2026-22719: VMware Aria Operations command injection during support-assisted migration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is an unauthenticated network-reachable command injection leading to remote code execution on a management platform and is listed in CISA KEV with known exploitation.

What it is

VMware Aria Operations contains a command injection flaw (CWE-77) that an unauthenticated attacker can use to run arbitrary commands, potentially achieving remote code execution. Exploitation is only possible while support-assisted product migration is in progress, which narrows the window but does not remove the risk. The issue affects Aria Operations and related VMware products including Cloud Foundation and Telco Cloud offerings.

Impact

An attacker gains arbitrary command execution on the Aria Operations host, which can lead to full remote code execution and compromise of the management platform. Because Aria Operations is a management plane component, compromise can expose managed infrastructure and credentials.

Attack surface

Reachable over the network (AV:N) with no authentication (PR:N) and no user interaction (UI:N), but the attack complexity is rated high (AC:H) because the migration-in-progress precondition must be met. The flaw is in the migration support path rather than a normal user-facing interface.

Exploitation

CVE-2026-22719 was added to CISA KEV on 2026-03-03 with a remediation due date of 2026-03-24, indicating known exploitation in the wild. EPSS gives a 30-day probability of 0.17424 (96.9th percentile), and no ransomware campaign use is documented.

What to do

• Apply the patches listed in the Fixed Version column of the VMSA-2026-0001 response matrix from Broadcom as the first action.
• If patching is not immediately possible, apply the workarounds documented in the Workarounds column of the same response matrix.
• Avoid or tightly control support-assisted product migration until the system is patched, since the vulnerability is only exploitable during that state.
• Restrict network access to Aria Operations management interfaces to trusted administrative networks.
• Follow BOD 22-01 guidance for cloud services or discontinue use of the product if no mitigation is available.

Detection

• Monitor Aria Operations and underlying OS logs for unexpected child processes or command execution during migration windows.
• Alert on anomalous outbound network connections or new listening services originating from Aria Operations hosts.
• Audit migration and support sessions for unexpected or unauthorized activity, and correlate with process creation telemetry.
• Track patch status of Aria Operations, Cloud Foundation and Telco Cloud instances against the VMSA-2026-0001 fixed versions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.